Security Not yet confirmed elsewhere 1 publisher 2 min read Published Aug 28, 2026, 5:19 AM PDT

ZBT router firmware ships two factory implants that beacon out on UDP/10000

SPEAKINGSTONE and DARKLANTERN both hand unauthenticated attackers root on ZBT-built hardware, and because neither advisory names a fixed firmware release, the remedy for an affected model is replacing it.

The Watch · Security desk

Send a correction

Illustration accompanying ZBT router firmware ships two factory implants that beacon out on UDP/10000 — Generated illustration

What happened

VulnCheck assigned CVE-2026-74232 and CVE-2026-74233 to two factory implants in ZBT router firmware, rating each 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1 with no privileges and no user interaction required.
SPEAKINGSTONE runs as the service yunmgrd and beacons outward over UDP port 10000 to a hardcoded controller, so it works from behind NAT and ordinary egress filtering.
DARKLANTERN listens as infosrvd on UDP port 9992, which the stock firewall opens to any internet address, and its authentication falls to a hardcoded salt and an all-zero wildcard MAC.
VulnCheck found 203 internet-facing DARKLANTERN instances across 22 countries between August 18 and August 21, a count of hosts that answered a probe rather than of confirmed compromises.
Both implants were present on an $88 Deep Orange LTE router bought from a US supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019.

Why it matters

Who has to decide decision Owners of the listed models have two options since patching is not available: keep running hardware with documented root access for an outside party, or replace the unit.
What it limits constraint The perimeter controls most networks lean on for cheap CPE do not contain an implant that initiates its own sessions, which pushes detection onto flow records and DNS logs.
What it costs cost At $88 a unit the replacement is a line item; the expense is the inventory work of finding which installed devices are ZBT builds sold under somebody else's brand.
What it sets up precedent Three implants surfacing in one vendor's firmware within a single month mean buyers now need to treat ZBT's build pipeline as suspect, not just the individual models.

Next story · Security · Oct 6

Atlassian tells Data Center customers to pull exposed servers offline over a 9.3 file-read flaw

Confirmed15 publishers

VulnCheck's own sinkhole produced the sharpest number in the disclosure and also the least representative one. SPEAKINGSTONE carries a hardcoded backup C2 domain that it reaches only where a primary server was never configured; the domain was unregistered, so VulnCheck registered it, stood up a reverse-engineered implementation of the protocol, and beacons began arriving as soon as the server was live ^[14]. By August 21, 392 unique devices had checked in, 390 of them in China ^[15], which leaves two outside it ^[20]. Of those, 363 self-reported the model L3_V2_8 on firmware 3.0.0.4.528 ^[16], or 92.6 percent of the sample ^[19]; 304 broadcast SSIDs beginning "CMCC" ^[16]; 83 percent sat on China Mobile's network ^[16], roughly 325 hosts ^[21]. Only units that were never given a primary C2 ever dial the backup, so the 392 is a floor drawn from an unrepresentative subset ^[17].

The version data is what turns this into a procurement decision. The advisory pages present affected builds as upper bounds, the CVE records name each firmware as a single exact build and set every other version's status to unknown, and no fixed release is named in either advisory ^[11]. An owner running a build outside the listed set has no published basis for deciding whether the implant is there.

Several entries in both CVE records sit under an unidentified vendor ^[18], so the published model lists are not the full set of names this firmware ships under. The Hacker News checked the IEEE-registered MAC prefix database on August 28 and found the blocks 78:A3:51 and F8:5E:3C both assigned to Shenzhen Zhibotong Electronics ^[13], and ZBT sells the same hardware and firmware to resellers that put their own name on the case ^[12]. The MAC address a device broadcasts identifies who built it more reliably than the brand printed on the case.

ENDLESSDOORS, the phone-home implant VulnCheck disclosed on August 5 in at least 20 Zbtlink models, is tracked as CVE-2026-66747 ^[10]. SPEAKINGSTONE's supported message types matter more than its CVSS rating: arbitrary command execution as root, exfiltration of the WAN PPPoE username and password, read and write access to a DNS hijack list, and a reverse SSH tunnel ^[6]. VulnCheck describes it as "a surveillance implant with root access to every device it runs on" ^[2]. The PPPoE credentials and the DNS list are the subscriber-facing attack; the tunnel is how an operator reaches whatever sits behind the router.

What to watch

A fixed firmware build from ZBT or any of its resellers, since neither VulnCheck advisory names one.
Whether third-party scanning of UDP/9992 converts the 203 DARKLANTERN probe responses into confirmed compromises.
Further implants in ZBT builds beyond ENDLESSDOORS, SPEAKINGSTONE and DARKLANTERN, and whether the same services turn up in other ODMs' firmware.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence64
Adoption38
Hype gap+12
Incentives72
Confidence62

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
VulnCheck disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each giving an unauthenticated remote attacker root command execution on affected devices.
Reported Supported Source: VulnCheck2 sources— create a free account to open them
[2]
VulnCheck said in its supply chain research: "This is a surveillance implant with root access to every device it runs on."
Reported Supported Source: VulnCheck2 sources— create a free account to open them
[3]
The implants were named SPEAKINGSTONE and DARKLANTERN by VulnCheck's zero-day research team and are tracked as CVE-2026-74232 and CVE-2026-74233 respectively.
Reported Supported1 source— create a free account to open them
[4]
VulnCheck, acting as CVE Numbering Authority, assigned both identifiers and rated each 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1, with vectors recording a network attack requiring no privileges and no user interaction.
Reported Supported1 source— create a free account to open them
[5]
SPEAKINGSTONE runs as the service yunmgrd and sends beacons over UDP port 10000 to a hardcoded command-and-control server; because it dials outward it functions from behind NAT and ordinary egress filtering.
Reported Supported1 source— create a free account to open them
[6]
SPEAKINGSTONE's protocol supports message types that execute arbitrary commands as root, exfiltrate the WAN PPPoE username and password, write and read a DNS hijack list, and open a reverse SSH tunnel.
Reported Supported1 source— create a free account to open them
[7]
DARKLANTERN operates as the service infosrvd on UDP port 9992, which the router's stock firewall opens to inbound connections from any internet address, and VulnCheck's advisory describes its authentication as ineffective, resting on a hardcoded salt and an all-zero wildcard MAC value that bypasses its own address check.
Reported Supported1 source— create a free account to open them
[8]
Between August 18 and August 21, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries, self-reporting 16 distinct models; the figure counts hosts that answered a probe rather than devices found compromised.
Reported Supported1 source— create a free account to open them
[9]
Both implants were found on an $88 Deep Orange 3G/4G/LTE Router bought from a U.S. supplier, a white-labeled ZBT-WE826-T2 whose firmware was built in 2019.
Reported Supported1 source— create a free account to open them
[10]
ENDLESSDOORS (CVE-2026-66747) is a phone-home implant VulnCheck disclosed on August 5 and found in at least 20 Zbtlink router models; the 2019-build Deep Orange unit predates it.
Reported Supported1 source— create a free account to open them
[11]
The advisory pages display affected firmware builds as upper bounds while the CVE records name each firmware as a single exact build and set the default status of every other version to unknown; neither advisory names a fixed firmware release, leaving an owner on a build outside the listed set without a published basis for deciding whether the flaw applies.
Reported Supported1 source— create a free account to open them
[12]
Model number rather than brand is the reliable check because ZBT sells the same hardware and firmware to resellers that put their own name on the case.
Reported Supported1 source— create a free account to open them
[13]
The Hacker News confirmed via the IEEE-registered MAC prefix database on August 28 that the blocks 78:A3:51 and F8:5E:3C are both assigned to Shenzhen Zhibotong Electronics.
Reported Supported Source: The Hacker News1 source— create a free account to open them
[14]
SPEAKINGSTONE carries a hardcoded backup C2 domain reached only where a primary server was never configured; VulnCheck found the domain unregistered, registered it, stood up a server running a reverse-engineered implementation of the protocol, and beacons began arriving as soon as the server was live.
Reported Supported1 source— create a free account to open them
[15]
As of August 21, 392 unique devices had reported in to VulnCheck's server, of which 390 were in China.
Reported Supported1 source— create a free account to open them
[16]
VulnCheck said 83 percent of the reporting devices were on China Mobile's network, that 304 of the 392 broadcast SSIDs beginning with "CMCC", and that 363 self-reported a single model, L3_V2_8, running firmware 3.0.0.4.528.
Reported Supported1 source— create a free account to open them
[17]
Because a device reaches the backup domain only where a primary C2 was never configured, the 392 is a floor drawn from an unrepresentative subset rather than a count of affected devices.
Reported Supported1 source— create a free account to open them
[18]
Several models and firmware builds in both CVE records are listed under an unidentified vendor, including CTN720-W1, LF-1541, MT7620N, WRC1, MoreQuick models, AP522, AP7628, HC5661A, APG721B, HK300 and MAP-N10.
Reported Supported1 source— create a free account to open them
[19]
The 363 devices self-reporting model L3_V2_8 are 92.6 percent of the 392 that beaconed to VulnCheck's server.
Derived Supported1 source— create a free account to open them
[20]
Two of the 392 devices that beaconed in were outside China.
Derived Supported1 source— create a free account to open them
[21]
83 percent of 392 reporting devices is about 325 hosts on China Mobile's network.
Derived Supported1 source— create a free account to open them
[22]
Three distinct factory implants in ZBT-built firmware were documented publicly within August 2026: ENDLESSDOORS on August 5, plus SPEAKINGSTONE and DARKLANTERN, whose scanning and telemetry run August 18 to August 21.
Derived Supported1 source— create a free account to open them

Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.

Add to ChatGPT Add to Claude

Sources

1 independent publisher whose own reporting we read for this story.

thehackernews.com
2 articles · August 28, 2026
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

The firmware anatomy is the part worth reading twice, and The Hacker News gives it: yunmgrd beaconing outward on UDP/10000, which is why NAT and ordinary egress rules never see a problem, and infosrvd sitting on UDP/9992 behind an authentication scheme that a hardcoded salt and an all-zero wildcard MAC walk straight through. The protocol's message types read like a product spec for surveillance — root command execution, PPPoE credential theft, a writable DNS hijack list, reverse SSH. What no one here follows up is the supply question a builder actually faces: a 2019 firmware build reached a U.S. supplier's shelf under the Deep Orange name, and nothing in this reporting tells an integrator how to audit what the factory left running before shipping someone else's board inside their own product.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence64: 0100
Concrete down to the hash, single in origin
The technical spine is unusually checkable: two service names, three UDP ports, three SHA-256 hashes, exact firmware strings, a named C2 domain. Nearly all of it originates with the party that found the implants, named them, assigned their identifiers and scored their severity. The Hacker News contributes three checks of its own — the IEEE prefix lookup tying 78:A3:51 and F8:5E:3C to Shenzhen Zhibotong, the primary C2 still resolving to an Alibaba Cloud address in Shenzhen on August 28, and the absence of all three identifiers from CISA's catalog version 2026.08.27 — and those are the only observations here not routed through the discloser. Our coverage holds that same report twice, which adds reach and no verification.
Adoption38: 0100
Two counts, neither of the population
Both numbers measure something narrower than "how many routers are exposed." The 203 hosts across 22 countries are machines that answered a probe, explicitly not machines found compromised. The 392 beacons are odder still: a device dials the backup domain only when no primary server was ever set, so the near-total concentration in China — 390 of 392, 363 of them one L3_V2_8 build, roughly 325 on China Mobile — describes the misconfigured tail rather than the installed base. Absent from all of it: units shipped, resellers served, and any evidence that a single owner has acted.
Hype gap+12: −100 understated0 aligned+100 overstated
Careful arithmetic, one loose thread on exploitation
This reporting hedges where hedging costs it something: it labels the 203 as probe responders, calls the 392 a floor from an unrepresentative subset, and notes that the sinkhole only catches misconfigured units. The overshoot is narrower and sits in the exploitation record. DARKLANTERN appears in the discloser's own known-exploited catalog, whose criteria require public reports of exploitation in the wild, while CISA's enrichment of the same identifier the day before rates it proof-of-concept and CISA's catalog lists none of the three. "Factory implant" and "surveillance implant" are the discloser's characterisation; nothing published here establishes who wrote the code or who operates ac-link[.]com.
Incentives72: 0100
The discloser held every pen
One party found the implants, chose the codenames, assigned both CVE identifiers as a numbering authority, set the 9.3 and 9.8 scores, registered the abandoned backup C2 and ran the sinkhole that produced the only telemetry, then listed one of the two in the exploited-vulnerability catalog it sells. That does not make the work wrong — hashes and ports are testable by anyone who cares to. But no adversarial party appears anywhere in this story: no word from Shenzhen Zhibotong, no reseller, no second lab, and no regulator, since the government catalog operators actually queue from does not carry these identifiers.
Confidence62: 0100
Firm on how it works, soft on how far it reaches
Read this as high trust in the mechanics and low trust in the scale. The ports, services, hashes and authentication defects are specific enough to be falsified quickly if wrong, and the identification path via model number and MAC prefix is repeatable by any owner. Scale is where it thins: one publisher, published twice, relaying one vendor, with an exposure picture drawn from a skewed sinkhole and a probe count that the report itself declines to equate with compromise.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

White-Label OEM RebrandingFollow
Vulnerability Disclosure and CVE GovernanceFollow
Router Firmware ImplantsFollow
Hardware Supply Chain Security Follow
Internet Exposure Measurement Follow